Skip to content

Fix moving credential to domain with unsafe URL characters #989

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
froque wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Fix moving credential to domain with unsafe URL characters #989

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 12 additions & 1 deletion src/main/java/com/cloudbees/plugins/credentials/CredentialsStoreAction.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1348,7 +1348,7 @@
for (CredentialsStore store : CredentialsProvider.lookupStores(context)) {
if (store.getContext() == context) {
for (Domain d : store.getDomains()) {
if (domainName.equals("_") ? d.getName() == null : domainName.equals(d.getName())) {
if (isDomainEqual(domainName, d)) {
destinationStore = store;
destinationDomain = d;
break;
Expand Down Expand Up @@ -1380,6 +1380,17 @@
return HttpResponses.redirectToDot();
}

private boolean isDomainEqual(String domainName, Domain d){
final var name = d.getName();
if (domainName.equals("_")) {

Check warning on line 1385 in src/main/java/com/cloudbees/plugins/credentials/CredentialsStoreAction.java

View check run for this annotation

ci.jenkins.io / Code Coverage

Partially covered line 

Line 1385 is only partially covered, one branch is missing
return name == null;

Check warning on line 1386 in src/main/java/com/cloudbees/plugins/credentials/CredentialsStoreAction.java

View check run for this annotation

ci.jenkins.io / Code Coverage

Not covered line 

Line 1386 is not covered by tests
}
if (name == null){
return false;
}
return domainName.equals(Util.rawEncode(name));
}

/**
* Updates the credentials.
*
Expand Down
68 changes: 68 additions & 0 deletions src/test/java/com/cloudbees/plugins/credentials/CredentialsStoreActionTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -294,6 +294,74 @@ void restCRUDNonHappy() throws Exception {
assertThat(con.getResponseCode(), is(HttpServletResponse.SC_CONFLICT));
}

@Test
void moveCredential() throws Exception {
JenkinsRule.WebClient wc = j.createWebClient();
j.getInstance().setCrumbIssuer(null);

assertThat(systemStore.getDomainByName("smokes"), nullValue());

// create domain
HttpURLConnection con =
postCreateByXml(systemStore, """
<com.cloudbees.plugins.credentials.domains.Domain>
<name>smokes</name>
</com.cloudbees.plugins.credentials.domains.Domain>""");
assertThat(con.getResponseCode(), is(200));

// create domain
con = postCreateByXml(systemStore, """
<com.cloudbees.plugins.credentials.domains.Domain>
<name>domain with spaces, ", ), characters</name>
</com.cloudbees.plugins.credentials.domains.Domain>""");
assertThat(con.getResponseCode(), is(200));

// create credential
con = postCreateByXml(systemStore, "smokes",
"""
<com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl>
<scope>GLOBAL</scope>
<id>smokey-id</id>
<description>created from xml</description>
<username>example-com-deployer</username>
<password>super-secret</password>
</com.cloudbees.plugins.credentials.impl.UsernamePasswordCredentialsImpl>""");
assertThat(con.getResponseCode(), is(200));

// read domain
WebResponse response = wc.goTo("credentials/store/system/domain/smokes/config.xml", "application/xml").getWebResponse();
assertThat(response.getContentAsString(), CompareMatcher.isIdenticalTo(
"""
<com.cloudbees.plugins.credentials.domains.Domain>
<name>smokes</name>
</com.cloudbees.plugins.credentials.domains.Domain>""").ignoreWhitespace().ignoreComments());

// move credential
con = postMove(systemStore, "smokes", "smokey-id", "domain with spaces, \", ), characters");
assertThat(con.getResponseCode(), is(200));

// read domain
response = wc.goTo("credentials/store/system/domain/domain with spaces, \", ), characters/config.xml", "application/xml").getWebResponse();
assertThat(response.getContentAsString(), CompareMatcher.isIdenticalTo(
"""
<com.cloudbees.plugins.credentials.domains.Domain>
<name>domain with spaces, ", ), characters</name>
</com.cloudbees.plugins.credentials.domains.Domain>""").ignoreWhitespace().ignoreComments());
}

private HttpURLConnection postMove(CredentialsStore store, String domainName, String credentialsId, String targetDomain)
throws IOException {
HttpURLConnection con = (HttpURLConnection) new URL(j.getURL(),
"credentials/store/" + store.getStoreAction().getUrlName() + "/domain/" + Util
.rawEncode(StringUtils.defaultIfBlank(domainName, "_"))+ "/credential/" + Util
.rawEncode(credentialsId) + "/doMove").openConnection();
con.setRequestMethod("POST");
con.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
con.setDoOutput(true);
con.getOutputStream().write(Util.rawEncode("destination=system/" + Util.rawEncode(targetDomain) + "&Submit").getBytes(StandardCharsets.UTF_8));
return con;
}

private HttpURLConnection postCreateByXml(CredentialsStore store, String xml)
throws IOException {
HttpURLConnection con = (HttpURLConnection) new URL(j.getURL(),
Expand Down
Loading